Update to 2021-12-01 19:13

roles/dokuwiki/templates/filebeat.yml.j2

@@ -0,0 +1,7 @@
+- type: log
+  enabled: True
+  paths:
+    - {{ dokuwiki_root_dir }}/data/cache/loglog.log
+  exclude_files:
+    - '\.[gx]z$'
+    - '\d+$'

roles/dokuwiki/templates/htaccess.j2

@@ -0,0 +1,17 @@
+<Files ~ "^([\._]ht|README$|VERSION$|COPYING$)">
+  Require all denied
+</Files>
+<IfModule alias_module>
+  RedirectMatch 404 /\.git
+</IfModule>
+
+RewriteEngine on
+RewriteRule ^_media/(.*)              lib/exe/fetch.php?media=$1   [QSA,L]
+RewriteRule ^_detail/(.*)             lib/exe/detail.php?media=$1  [QSA,L]
+RewriteRule ^_export/([^/]+)/(.*)     doku.php?do=export_$1&id=$2  [QSA,L]
+RewriteRule ^$                        doku.php  [L]
+RewriteCond %{REQUEST_FILENAME}       !-f
+RewriteCond %{REQUEST_FILENAME}       !-d
+RewriteRule (.*)                      doku.php?id=$1  [QSA,L]
+RewriteRule ^index.php$               doku.php
+

roles/dokuwiki/templates/httpd.conf.j2

@@ -0,0 +1,41 @@
+{% if dokuwiki_alias is defined %}
+Alias /{{ dokuwiki_alias }} {{ dokuwiki_root_dir }}/web
+{% else %}
+# No alias defined, create a vhost to access it
+{% endif %}
+
+<Directory {{ dokuwiki_root_dir }}/web>
+  AllowOverride All
+  Options FollowSymLinks
+{% if dokuwiki_src_ip is defined %}
+  Require ip {{ dokuwiki_src_ip | join(' ') }}
+{% else %}
+  Require all granted
+{% endif %}
+  <FilesMatch \.php$>
+    SetHandler "proxy:unix:/run/php-fpm/{{ dokuwiki_php_fpm_pool | default('dokuwiki_' + dokuwiki_id | string) }}.sock|fcgi://localhost"
+  </FilesMatch>
+
+  <FilesMatch "^(\.ansible_version|\.git.*|README(\.md)?|LICENSE|AUTHORS|.*\.cnf|\.htaccess|_deprecated\.txt|plugin\.info\.txt)">
+    Require all denied
+  </FilesMatch>
+
+{% if httpd_src_ip is defined and httpd_src_ip | length > 0 and '0.0.0.0/0' not in httpd_src_ip and dokuwiki_auth == 'authhttpldap' %}
+  RewriteEngine On
+  RewriteCond %{HTTP:Auth-User} ^(\w+)$
+  RewriteRule .* - [E=REMOTE_USER:%1]
+{% endif %}
+</Directory>
+
+<DirectoryMatch {{ dokuwiki_root_dir }}/web/lib/plugins/\w+/conf>
+  Require all denied
+</DirectoryMatch>
+<Directory {{ dokuwiki_root_dir }}/web/conf>
+  Require all denied
+</Directory>
+<Directory {{ dokuwiki_root_dir }}/web/inc>
+  Require all denied
+</Directory>
+<Directory {{ dokuwiki_root_dir }}/web/config>
+  Require all denied
+</Directory>

roles/dokuwiki/templates/local.php.j2

@@ -0,0 +1,14 @@
+<?php
+$conf['lang'] = 'fr';
+$conf['license'] = '';
+$conf['superuser'] = '@admins,admin';
+$conf['showuseras'] = 'username';
+$conf['passcrypt'] = 'sha512';
+$conf['disableactions'] = 'register';
+$conf['subscribers'] = 1;
+$conf['userewrite'] = '1';
+$conf['useslash'] = 1;
+{% if 'bootstrap3' in dokuwiki_tpl_to_install %}
+$conf['template'] = 'bootstrap3';
+{% endif %}
+?>

roles/dokuwiki/templates/local.protected.php.j2

@@ -0,0 +1,37 @@
+<?php
+
+$conf['useacl'] = 1;
+$conf['savedir'] = '{{ dokuwiki_root_dir }}/data';
+
+$conf['authtype'] = '{{ dokuwiki_auth }}';
+{% if dokuwiki_auth == 'authldap' or dokuwiki_auth == 'authhttpldap' %}
+$conf['plugin']['{{ dokuwiki_auth }}']['server'] = "{{ dokuwiki_ldap_uri }}";
+$conf['plugin']['{{ dokuwiki_auth }}']['starttls'] = {{ dokuwiki_ldap_starttls | ternary('1','0') }};
+$conf['plugin']['{{ dokuwiki_auth }}']['version'] = '3';
+$conf['plugin']['{{ dokuwiki_auth }}']['usertree'] = '{{ dokuwiki_ldap_user_base }}';
+$conf['plugin']['{{ dokuwiki_auth }}']['attributes'] = array();
+$conf['plugin']['{{ dokuwiki_auth }}']['grouptree'] = '{{ dokuwiki_ldap_group_base }}';
+$conf['plugin']['{{ dokuwiki_auth }}']['userfilter'] = '{{ dokuwiki_ldap_user_filter }}';
+$conf['plugin']['{{ dokuwiki_auth }}']['groupfilter'] = '{{ dokuwiki_ldap_group_filter }}';
+$conf['plugin']['{{ dokuwiki_auth }}']['groupkey'] = '{{ dokuwiki_ldap_group_key }}';
+{% if dokuwiki_ldap_bind_dn is defined and dokuwiki_ldap_bind_pass is defined %}
+$conf['plugin']['{{ dokuwiki_auth }}']['binddn'] = '{{ dokuwiki_ldap_bind_dn }}';
+$conf['plugin']['{{ dokuwiki_auth }}']['bindpw'] = '{{ dokuwiki_ldap_bind_pass }}';
+{% endif %}
+{% elif dokuwiki_auth == 'authad' %}
+$conf['plugin']['authad']['base_dn'] = '{{ dokuwiki_ad_user_base }}';
+$conf['plugin']['authad']['domain_controllers'] = '{{ dokuwiki_ad_dc | join(', ') }}';
+{% if dokuwiki_ad_bind_user is defined and dokuwiki_ad_bind_pass is defined %}
+$conf['plugin']['authad']['admin_username'] = '{{ dokuwiki_ad_bind_user }}';
+$conf['plugin']['authad']['admin_password'] = '{{ dokuwiki_ad_bind_pass }}';
+{% endif %}
+{% if dokuwiki_ad_domain is defined %}
+$conf['plugin']['authad']['account_suffix'] = '@{{ dokuwiki_ad_domain }}';
+{% endif %}
+$conf['plugin']['authad']['sso'] = 1;
+$conf['plugin']['authad']['use_tls'] = {{ dokuwiki_ad_starttls | ternary('1','0') }};
+$conf['plugin']['authad']['recursive_groups'] = 1;
+$conf['plugin']['authad']['expirywarn'] = 15;
+{% endif %}
+
+?>

roles/dokuwiki/templates/perms.sh.j2

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+restorecon -R {{ dokuwiki_root_dir }}
+chown root:root {{ dokuwiki_root_dir }}
+chmod 700 {{ dokuwiki_root_dir }}
+setfacl -k -b {{ dokuwiki_root_dir }}
+setfacl -m u:{{ dokuwiki_php_user | default('apache') }}:rx,u:{{ httpd_user | default('apache') }}:rx {{ dokuwiki_root_dir }}
+chown -R root:root {{ dokuwiki_root_dir }}/web
+chown -R {{ dokuwiki_php_user | default('apache') }} {{ dokuwiki_root_dir }}/web/lib/{plugins,tpl}
+chown -R {{ dokuwiki_php_user }} {{ dokuwiki_root_dir }}/{tmp,sessions,cache,data}
+chmod 700 {{ dokuwiki_root_dir }}/{tmp,sessions,cache,data}
+find {{ dokuwiki_root_dir }}/web -type f -exec chmod 644 "{}" \;
+find {{ dokuwiki_root_dir }}/web -type d -exec chmod 755 "{}" \;
+chown -R :{{ dokuwiki_php_user }} {{ dokuwiki_root_dir }}/web/conf
+find {{ dokuwiki_root_dir }}/web/conf -type f -exec chmod 660 "{}" \;
+find {{ dokuwiki_root_dir }}/web/conf -type d -exec chmod 770 "{}" \;

roles/dokuwiki/templates/php.conf.j2

@@ -0,0 +1,37 @@
+; {{ ansible_managed }}
+
+[dokuwiki_{{ dokuwiki_id }}]
+
+listen.owner = root
+listen.group = {{ httpd_user | default('apache') }}
+listen.mode = 0660
+listen = /run/php-fpm/dokuwiki_{{ dokuwiki_id }}.sock
+user = {{ dokuwiki_php_user }}
+group = {{ dokuwiki_php_user }}
+catch_workers_output = yes
+
+pm = dynamic
+pm.max_children = 15
+pm.start_servers = 3
+pm.min_spare_servers = 3
+pm.max_spare_servers = 6
+pm.max_requests = 5000
+request_terminate_timeout = 60m
+
+php_flag[display_errors] = off
+php_admin_flag[log_errors] = on
+php_admin_value[error_log] = syslog
+php_admin_value[memory_limit] = 256M
+php_admin_value[session.save_path] = {{ dokuwiki_root_dir }}/sessions
+php_admin_value[upload_tmp_dir] = {{ dokuwiki_root_dir }}/tmp
+php_admin_value[sys_temp_dir] = {{ dokuwiki_root_dir }}/tmp
+php_admin_value[post_max_size] = 50M
+php_admin_value[upload_max_filesize] = 50M
+php_admin_value[disable_functions] = system, show_source, symlink, exec, dl, shell_exec, passthru, phpinfo, escapeshellarg, escapeshellcmd
+php_admin_value[open_basedir] = {{ dokuwiki_root_dir }}
+php_admin_value[max_execution_time] = 300
+php_admin_value[max_input_time] = 60
+php_admin_flag[allow_url_include] = off
+php_admin_flag[allow_url_fopen] = on
+php_admin_flag[file_uploads] = on
+php_admin_flag[session.cookie_httponly] = on

roles/dokuwiki/templates/plugins.protected.php.j2

@@ -0,0 +1,3 @@
+<?php
+
+$plugins['{{ dokuwiki_auth }}'] = 1;